External risk intelligence

PraisonAI Call Server Unauthenticated Agent Control API Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47396

The vulnerability involves an API server that binds to 0.0.0.0 by default, exposing an unauthenticated agent control plane to the network. Since this component is designed to be a network-facing service or API router, it is commonly deployed in environments where it may be reachable over a network, making remote exposure to the internet a likely outcome if not properly secured.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in PraisonAI's call server, specifically affecting how it handles agent control. When a specific token is not configured, the system's network-facing API can be accessed without any authentication. This means unauthorized users could potentially control, inspect, or unregister agents, posing a significant security risk if the call server is exposed to a network.

Unauthenticated access to agent controls.
Critical flaw could impact agent operations.
Confirm exposure and ensure proper token configuration.

Attack Path

How an attacker could exploit the issue

An attacker can interact with the PraisonAI call server remotely if the `CALL_SERVER_TOKEN` is not configured, allowing them to control agents. This occurs because the agent control API is exposed without authentication by default when the token is unset. The vulnerability can lead to unauthorized listing, inspection, invocation, and unregistration of agents.

Network access required.
Unauthenticated API endpoint.
Unauthorized agent control.

Live Threat

Current exploitation, exposure, and threat context

When the PraisonAI call server is launched without configuring `CALL_SERVER_TOKEN`, its agent control API becomes accessible remotely without authentication. This could allow unauthorized users to interact with system agents, potentially leading to unintended service behavior or unauthorized access to agent information.

Agent control plane data.
Unauthenticated API access.
Unauthorized agent control actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in PraisonAI's call server, which exposes an unauthenticated agent control API, likely impacts platform or application teams responsible for deploying and managing the PraisonAI system. The first practical step is to identify all instances of the call server, determine their network exposure and criticality, and then engage the accountable owner to plan remediation.

Platform/Application teams own this issue.
Verify `CALL_SERVER_TOKEN` configuration and network exposure.
Plan and implement the upgrade to version 4.6.40.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PraisonAI and its call server?

PraisonAI is a framework for building and orchestrating multi-agent systems where AI agents collaborate to complete tasks. The call server component provides a network-accessible API specifically designed to manage these agents. It functions as a control plane, allowing developers to programmatically list, inspect, or invoke agents via network requests rather than just through local code execution.

What does CVE-2026-47396 mean for my system?

This vulnerability is classified as Improper Access Control and Missing Authentication for Critical Function. In simple terms, the software includes a security gate meant to restrict who can control agents, but that gate fails to close if a specific configuration token is missing. Because the authentication mechanism defaults to an 'open' state, the system essentially behaves as if no security is required when the token is unset, granting full control to anyone who can reach the API.

How can an attacker trigger this vulnerability?

An attacker can trigger this by sending network requests to the API endpoints managed by the `praisonai.api.call` component. The flaw is only triggered when the `CALL_SERVER_TOKEN` environment variable is not set. If an administrator has properly configured this token, the authentication helper will correctly validate requests, preventing unauthorized access even if the server is otherwise accessible.

Is my PraisonAI instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant because the call server binds to 0.0.0.0 by default. This makes the service and its agent control API potentially reachable over any network it is connected to. If your instance is deployed in a way that allows external network traffic to reach that port, the absence of a configured token creates an unauthenticated path for remote control.

How do I secure my installation?

The most effective way to resolve this is to upgrade to version 4.6.40 or later, which addresses the flaw. As an immediate protective measure, you should verify that the `CALL_SERVER_TOKEN` is explicitly configured in your environment variables. Additionally, review your network configuration to ensure that the call server is not unnecessarily exposed to untrusted networks or the public internet.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.